disable stig for now

.gitea/workflows/gitea-main-ci.yaml

@@ -63,7 +63,7 @@ env:
   # DISA STIG hardening (OpenSCAP + SSG, diskless/UKI/kiosk tailoring). Report-only
   # in CI: the scan + deviations report are published as artifacts; the build is
   # never failed on score. Set "false" to skip hardening (boot/secure-path bench).
-  ENABLE_STIG: "true"
+  ENABLE_STIG: "false"
   # ===========================================================================
   # TEMPORARY: 802.1X + MACsec are DISABLED for this build (rd.dot1x=0) so the
   # UKI / rootfs / NVMe-oF boot path can be validated on an OPEN switch port.

diskless.pkr.hcl

@@ -133,7 +133,7 @@ variable "boot_splash" {
 variable "enable_stig" {
   type        = bool
   description = "true (default): apply DISA STIG hardening (OpenSCAP + SSG) with a diskless/UKI/kiosk tailoring (files/stig/diskless-tailoring.xml), bake STIG kernel params into the UKI cmdline, and emit a deviations report. false: skip hardening entirely — escape hatch if a build regresses the boot/secure-path bench. FIPS is OFF and audit offload is LOCAL-only regardless (see docs/stig-deviations.md)."
-  default     = false
+  default     = true
 }
 
 variable "debug_shell" {